12 ms·

European court rules companies must tell employees of email checks

244 points by mcone 9y ago

ocdtrekkie 9y ago
Hmmm... I am pretty pro-privacy, but I am unsure that an employee's corporate email account should qualify, particularly given that anything said by it could be construed as a statement by the company itself. If the employee was not notified email monitoring could happen when they were hired, I suppose that's a problem, but I almost feel like that should even be common sense. The article suggests more employees are using their work email for personal purposes, and that is really the problem, I think. Particularly because it places your personal data inside your employer's control, and your employer can terminate that account at any time. It would be much more preferred if you connect your personal account to your work devices as well, so that you still have a clearly denoted personal/corporate firewall in your communications, but can still access both from work. I don't think employers which heavily monitor their employee's corporate email are... good employers, persay, but I'd question any suggestion they shouldn't have the right to.
- simion314 9y ago
  IT seems the employer needs to tell you if they spy/monitor your emails and this should extend if they spy on your screen or activity. If the worker is informed all should be fine then,it seems a very logical solution. Edit I used the wrong email address in the past by mistake, it can happen if you have a few email addresses setup in Thunderbird and similar, after I done the mistake I made sure to double check the email address I used(I worked remote from my own PC).
- BartSaM 9y ago
  This is not about the right of an employer to check email, this is about the right of an employee to know about it.
- rowyourboat 9y ago
  They do have the right to monitor, they just have to tell the employees that they are monitoring.
  - II2II 9y ago
    The distinction is understood, but should it be necessary for employers to explicitly express that the use of company resources may be monitored? Then again, I get the impression that I was brought up in a very different way from most people since I regularly have to explain seemingly minor details to coworkers. To explain how these seemingly petty policies are there to avoid problems that may rarely pop-up on small scales, yet are tangible costs/risks when a business has hundreds or thousands of employees.
    - s73ver_ 9y ago
      "The distinction is understood, but should it be necessary for employers to explicitly express that the use of company resources may be monitored?" Yes. I honestly don't see any downside to this. Informing people of things allows them to make better decisions on, say, where to work.
    - rowyourboat 9y ago
      > but should it be necessary for employers to explicitly express that the use of company resources may be monitored? Yes. Legally, in Europe, the expectation is that communication is private, and if you want to listen in, you need to get permission. Owning and operating telecommunication equipment does not give you the right to listen to its users.
- Allower 9y ago
  You assume there is a distinct boundary between work and personal life, like it or not (i profoundly dislike it) this is becoming more and more of a grey area.
- TallGuyShort 9y ago
  The other aspect I see here is that the ability to get into a former employee's email account may be important for business continuity. Employee dies or leaves suddenly? They may have access to online accounts or information in their email that didn't quite make it onto the corporate wiki or that no one else had access to (although a good company would minimize that). Important to be able to get in there and just get stuff done. On the other hand - just the other day I was looking at "Blind" (because it got advertized on my Instagram feed) that claims to be a "private"-ish social network for employees of a company to share information. Many of the reviews claim there are ulterior motives, etc. but the chief complaint seems to be that it requires verification through work email, and obviously that's begging for your employer to find out about your involvement in these back channels. Online employer verification that doesn't give yourself away, and isn't as easy to spoof as LinkedIn? That seems like a hard problem to solve...
  - izacus 9y ago
    Not being able to read dead employee's emails seems like a really tiny inconvenience (especially since there are so many ways an employee can effectively delete mails that you're doing something catastrophically wrong if your business continuity is dependant upon a mail account access) in comparison of constant monitoring of peoples private communication.
    - TallGuyShort 9y ago
      And "we may need to occasionally access your account on company-run email servers" is also a really different thing in contrast with "constant monitoring of peoples private communication". I doubt any company really gets a positive ROI on constantly monitoring people's chats, so it's their loss. I think other commenters have made a sufficiently good case for your work email not being considered private communication anyway. I mean, you're also doing something catastrophically wrong personally if your privacy is dependent on a company wanting to read company-related data on their own infrastructure but thinking, "Oh, no... a European court might frown on this..."
- mamon 9y ago
  In one of my previous jobs I was specificly encouraged (during introductory employee training) to use my work email for personal stuff, as all access to private email boxes was cut off by proxy servers. I wonder how many people fell for that.
  - mseebach 9y ago
    If they are blocking access to private email, it probably because of a regulatory requirement (common in finance) that they absolute must monitor and record everything going in and out. If that the case, and they didn't make that clear, then that's of course bad.
  - duxup 9y ago
    Cutting off access to other email services in some cases can be a good choice.
- pmiller2 9y ago
  > given that anything said by it could be construed as a statement by the company itself. I don't think this reasoning holds up in this case, given that it was a Yahoo! messenger account with private messages to the employee's brother and fiancee that were in question. That aside, there are different standards in Europe, IIRC, for things like using work email and network resources for personal use. Most employers I'm aware of don't mind occasional personal use, even while at work, within reasonable parameters (e.g. browsing porn at work probably would not fly at most places, possibly even if it's only on the work network after hours). Many of us posting here now are probably posting from work. Another commenter mentioned that his wife occasionally sends him mail at his work email because she thinks it would be faster or something. All of these would probably be broadly acceptable outside of places like finance or defense contracting that heavily monitor and regulate their networks. I don't think such things are generally considered acceptable in Europe. (I am happy to be proven wrong, if anyone has firsthand knowledge, however.) I expect my work email to be monitored, because that's how US corporations work. I would never use my work email address to sign up for anything personal and important. I've got a device in my pocket that's linked to my personal email if I want to access something like that at work, anyway. In spite of my expectation that I'll be monitored using work accounts and on the work network, I still believe people should be told so explicitly. Not only should they be told that monitoring will occur, but they should be fully notified of what is and is not acceptable. This just seems basic to me. Oh, and BTW, and FYI, it's per se.
Karunamon 9y ago
Yeah.. I can't really find anything wrong or onerous with requiring a disclosure. Everyone should know, but just in case they don't, a piece of paper explaining this during onboarding isn't a huge deal.
- koolba 9y ago
  Where doesn't it end? You yourself just said that everyone should know. Rather than creating needless paperwork for everybody they'd be better served with a public relations campaign by the government to teach people that your work email is owned by your company which means they can read and monitor it.
  - Karunamon 9y ago
    Somewhere around where the slippery slope fallacy starts. Snark aside, there's no real downside to mandating something in an employment contract that is probably already in most employment contracts anyways. This catches the stragglers.
    - gjjrfcbugxbhf 9y ago
      Why don't governments produce standard draft employment contacts? They already do so for many things (e.g. buying/renting property). Employer could ignore the standard or modify it and the employee could still amend it but it would help small companies get this sort of thing right and help with protecting both parties (which is the point of an employment contract).
      - vertex-four 9y ago
        In practice, lawyers will produce/modify standard contracts for extremely cheap, and as a bonus, if something goes wrong, you now have a relationship with a lawyer. If you're really cheap, in my country, you can literally go to the local book store and pick a model contract off the shelf. I don't think this is a problem that needs solving by the Government, since these contracts are essentially a commodity and have wound up being priced as such.
kozhevnikov 9y ago
It will as useful as EU's cookie law. Every employee on joining any company will be notified that corporate emails are monitored, similar to 'CCTV in operation' signs. It will be another checkbox on the contract.
- golergka 9y ago
  > It will be another checkbox on the contract. In my experience, employee contracts are negotiable in practice. I negotiated limiting or removing 'non-compete' clauses several times in different companies. If email checks were important for me (they're not) I would negotiate this term as well.
  - ghughes 9y ago
    I doubt you’d get very far trying to negotiate this with any employer that has a legal department.
    - cannonedhamster 9y ago
      I've gotten non-disparagement clauses removed from a company with a legal team. If you're going to work for a company and they aren't willing to negotiate when things are the best between you two, you're likely not going to enjoy working there.
    - _delirium 9y ago
      In some European countries the union does this kind of negotiating in a sector/framework agreement, which can make pushing back against those kinds of blanket terms more effective, at least to the extent of reducing how broad the rights waivers are.
    - fulafel 9y ago
      There's a range of company sizes and attitudes to lawyering between the extremes of "we don't have a lawyer" and "corporate lawyers run the place".
    - golergka 9y ago
cbg0 9y ago
You can grab a PDF with more details from the European Court of Human Rights here: https://hudoc.echr.coe.int/eng-press?i=003-5825428-7419362 https://hudoc.echr.coe.int/eng-press?i=003-5825428-7419362 And judgement: https://hudoc.echr.coe.int/eng#{"itemid":["001-177082"] https://hudoc.echr.coe.int/eng#{"itemid":["001-177082"]}
PeachPlum 9y ago
This case is confused. The title and some of the editorial say "email" but the messages were sent via Yahoo Messenger, which isn't email. > The company had presented him with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use. I know the distinction is a fine one, but it is still a difference. They didn't need to produce a message, just having a non-business contact would have sufficed.
- s73ver_ 9y ago
  I don't think the court really cares if the messages were actual emails or if they were IMs. To them, the difference is immaterial.
turk183 9y ago
Big Brother running along unabated.
- pmiller2 9y ago
  That's the point of the ruling. The court just abated it.
KineticLensman 9y ago
The ruling itself is at [1]. It's a long slog at approx 200 paragraphs of legalese. The conclusions were that Article 8 [2] had been violated, and that as a result some of the applicant’s legal costs should be paid (EUR 1,365) but dismissed the applicant’s claim for substantial damages (loss of earnings and social standing, fiancée terminating their relationship). [1] https://hudoc.echr.coe.int/eng#{%22languageisocode%22:[%22ENG%22],%22documentcollectionid2%22:[%22JUDGMENTS%22],%22itemid%22:[%22001-177082%22] https://hudoc.echr.coe.int/eng#{%22languageisocode%22:[%22EN...} [2] Any person shall be enabled: (a) to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file; (b) to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form; ... (d) to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.”
PeachPlum 9y ago
While I have no desire to read an employees private correspondance, am even less desirous of paying money to store data I will get prosecuted for looking at!
- babygoat 9y ago
  Then don't.
  - PeachPlum 9y ago
    People leave / die / are sick / go on holiday "I can't look in that Inbox, there might be an email from his brother" Puhleeze
    - s73ver_ 9y ago
      I've never needed to look into someone else's email because they weren't there.
      - zlynx 9y ago
        It happens all the time. Say that Adam handles technical support for some of your best customers, but he's out with pneumonia, or some other serious illness. He's not going to be responding to that urgent request for help with a new API feature, so you need to assign his inbox to Brian. Yes, if Adam had notice he was going to be out there'd be a controlled handoff, but that didn't happen, so you have to just open up his email and move onwards.
        viridian 9y ago
        I have never in my life seen this happen. Typically we use mailing distributions where I work to avoid this issue. We also can only respond to clients using specific email addresses, like the one tied to the mailbox that multiple people have access to.
        s73ver_ 9y ago
Delphiza 9y ago
The judgement highlights the balancing of "respect for his private life, on the one hand, and his employer’s right to take measures in order to ensure the smooth running of the company, on the other". While it is fair to expect that one "follows the rules", breach should not imply that your private life is something that the employer can do with what they wish, Especially, as the court decision notes, when the risks (e.g. damage and liability) are theoretical. Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private? It seems that the judgement is less about the monitoring and notification thereof, but whether or not you have an expectation for private things to remain private at work.
- Godel_unicode 9y ago
  > ...whether or not you have an expectation for private things to remain private at work Or to frame that question another way, if you have an expectation of privacy when you have taken no steps to ensure it and other privacy-protecting options abound. To extend your example, your wife could simply email your work address to say "you've got mail".
- zeveb 9y ago
  > Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private? I think that any expectation of privacy when using work resources to communicate is unreasonable — IOW, I believe it's illogical to expect that the company will not be aware of the fact that one has communicated. The question of whether the company may use the contents of such messages for its own purposes is a bit trickier, and I can see arguments in either direction. The best course of action is don't use an employer's resources for private purposes; then one cannot go astray.
  - izacus 9y ago
    It's important to note that a lot of these privacy rules from a time when mobile phones and computers were not common. As such, pretty much the only way to contact an employee inside a workplace (for medical, personal, family, etc.) reasons was via company owned equipment. If your wife had to tell you she has cancer, she HAD to use the company equipment. As such, the stance was that it's resonable that workers can expect privacy even when phoning their family between breaks with company hardware. This is important to prevent employers abusing this information to gain leverage over workers (and if I recall, even in USA certain information is protected). And this is STILL the case in many industries - you're not allowed to carry your phone with you on a factory floor, so when something important happens, your personal communication MUST go through company owned equipment. In those cases, ensuring that employers don't needlessly invade employee privacy is rather reasonable. Remember, most of the world's workers aren't rockstar developers sitting in an office with their phones in the pocket.
izzydata 9y ago
Everything about this is fine and dandy, but I don't understand why anyone would use their work email for personal use. An email address isn't a difficult to obtain resource. Anyone can make a hundred email addresses and use all of them for different things. I guess the guy just never thought of it as an issue even if he was being monitored until it became an issue. I don't know.
- nthao0ent23 9y ago
  I'm finding them harder and harder to obtain privately. I wanted a free throw away email address recently, so I tried a few of the big names - yahoo, hotmail, outlook, gmail. I couldn't see a way to sign up for any one of these without giving out an existing email address to them. If I wanted something unconnected to anything else, I had no way to do that. I'm not sure how someone getting on the internet for the first time would do it with any free service. I'm not opposed to paying for an email account, but it does create a barrier to entry.
  - piaste 9y ago
    Gmail asks you for your current email address, but it isn't actually required. I just tried it and made a new account in two clicks. I assume the same applies to at least some of the others.
  - dkersten 9y ago
    If its throwaway, perhaps something like mailinator would do the trick?
  - icebraining 9y ago
    Try outside the big ones? It takes only a few minutes to find one host that allows one to register without such stupidity.
- 1_800_UNICORN 9y ago
  The number one reason I've seen is for things that need visibility during the work day. For example, if my girlfriend needs to email me something I need to take action on during the work day, she knows to email my work email. Same with people who are doing time sensitive things for me (e.g. my realtor during a recent home purchase). Sure, I could start monitoring my personal email just as closely as my work email, but it's preferable for me (and probably preferable for my company) that I use my work email for work & time sensitive personal items, and use my personal email only outside of work for non-time sensitive personal matters.
mc32 9y ago
Will this apply to automated email screening, the kind the big companies very likely do to get alerted to IP theft and the like? I would have to believe the likes of FB, Aapl, GOOG, MSFT, etc. likely have some process in place to detect exfiltration.
lisper 9y ago
I don't understand why this is even remotely controversial. I am as jealous a guard of my personal privacy as anyone, but I would expect my employer to be able to monitor my work-related email. The resolution is simple: conduct your personal correspondence through a separate email account that is not owned by your employer. In fact, I keep strictly segregated work and personal email, and I run my own company!
- distances 9y ago
  And I expect my employer to leave all my communication unmonitored, be it e-mail, snail mail or private face-to-face discussions. Here, controversy created.
  - lisper 9y ago
    OK, please explain to me why you think that's reasonable?
    - distances 9y ago
      That's what the law says in Finland. Also, I personally believe the confidentiality of communication should never depend on the used medium or the ownership of the equipment used for the communication.
      - lisper 9y ago
        It's not about the ownership of the equipment, it's about whether the communications are official actions performed by an employee on behalf of the company. If they are, then the employer obviously (IMHO) has a right to know about them. And the best way to keep things from getting complicated (again IMHO) is to segregate work email (which the employer can read) from personal email (which no one but the user can read) in separate accounts. I really don't see how any reasonable person could disagree with that.
duxup 9y ago
I get there is a different tradition in Europe than compared to what I'm used to and that's cool. For me my company email is a company provided resource that they own and it belongs to them entirely. That includes their ability to monitor, read, or do most anything. No matter what the legal protections it seems like mixing personal life with work resources / tools carries an infinite number of possible issues and complications.
ucaetano 9y ago
Yay, another useless piece of information, like the "we use cookies" and "this entire building contains chemicals known to the state of California to cause cancer".
Kenji 9y ago
People who do private things with their work email are idiots. Separate work and private life clearly, it'll save you tons of headaches. They could dump the entirety of my work email publicly and I couldn't care less.

244 points by mcone 9y ago

Hmmm... I am pretty pro-privacy, but I am unsure that an employee's corporate email account should qualify, particularly given that anything said by it could be construed as a statement by the company itself. If the employee was not notified email monitoring could happen when they were hired, I suppose that's a problem, but I almost feel like that should even be common sense. The article suggests more employees are using their work email for personal purposes, and that is really the problem, I think. Particularly because it places your personal data inside your employer's control, and your employer can terminate that account at any time. It would be much more preferred if you connect your personal account to your work devices as well, so that you still have a clearly denoted personal/corporate firewall in your communications, but can still access both from work. I don't think employers which heavily monitor their employee's corporate email are... good employers, persay, but I'd question any suggestion they shouldn't have the right to.

simion314 9y ago
IT seems the employer needs to tell you if they spy/monitor your emails and this should extend if they spy on your screen or activity. If the worker is informed all should be fine then,it seems a very logical solution. Edit I used the wrong email address in the past by mistake, it can happen if you have a few email addresses setup in Thunderbird and similar, after I done the mistake I made sure to double check the email address I used(I worked remote from my own PC).
BartSaM 9y ago
This is not about the right of an employer to check email, this is about the right of an employee to know about it.
rowyourboat 9y ago
They do have the right to monitor, they just have to tell the employees that they are monitoring.
- II2II 9y ago
  The distinction is understood, but should it be necessary for employers to explicitly express that the use of company resources may be monitored? Then again, I get the impression that I was brought up in a very different way from most people since I regularly have to explain seemingly minor details to coworkers. To explain how these seemingly petty policies are there to avoid problems that may rarely pop-up on small scales, yet are tangible costs/risks when a business has hundreds or thousands of employees.
  - s73ver_ 9y ago
    "The distinction is understood, but should it be necessary for employers to explicitly express that the use of company resources may be monitored?" Yes. I honestly don't see any downside to this. Informing people of things allows them to make better decisions on, say, where to work.
  - rowyourboat 9y ago
    > but should it be necessary for employers to explicitly express that the use of company resources may be monitored? Yes. Legally, in Europe, the expectation is that communication is private, and if you want to listen in, you need to get permission. Owning and operating telecommunication equipment does not give you the right to listen to its users.
Allower 9y ago
You assume there is a distinct boundary between work and personal life, like it or not (i profoundly dislike it) this is becoming more and more of a grey area.
TallGuyShort 9y ago
The other aspect I see here is that the ability to get into a former employee's email account may be important for business continuity. Employee dies or leaves suddenly? They may have access to online accounts or information in their email that didn't quite make it onto the corporate wiki or that no one else had access to (although a good company would minimize that). Important to be able to get in there and just get stuff done. On the other hand - just the other day I was looking at "Blind" (because it got advertized on my Instagram feed) that claims to be a "private"-ish social network for employees of a company to share information. Many of the reviews claim there are ulterior motives, etc. but the chief complaint seems to be that it requires verification through work email, and obviously that's begging for your employer to find out about your involvement in these back channels. Online employer verification that doesn't give yourself away, and isn't as easy to spoof as LinkedIn? That seems like a hard problem to solve...
- izacus 9y ago
  Not being able to read dead employee's emails seems like a really tiny inconvenience (especially since there are so many ways an employee can effectively delete mails that you're doing something catastrophically wrong if your business continuity is dependant upon a mail account access) in comparison of constant monitoring of peoples private communication.
  - TallGuyShort 9y ago
    And "we may need to occasionally access your account on company-run email servers" is also a really different thing in contrast with "constant monitoring of peoples private communication". I doubt any company really gets a positive ROI on constantly monitoring people's chats, so it's their loss. I think other commenters have made a sufficiently good case for your work email not being considered private communication anyway. I mean, you're also doing something catastrophically wrong personally if your privacy is dependent on a company wanting to read company-related data on their own infrastructure but thinking, "Oh, no... a European court might frown on this..."
mamon 9y ago
In one of my previous jobs I was specificly encouraged (during introductory employee training) to use my work email for personal stuff, as all access to private email boxes was cut off by proxy servers. I wonder how many people fell for that.
- mseebach 9y ago
  If they are blocking access to private email, it probably because of a regulatory requirement (common in finance) that they absolute must monitor and record everything going in and out. If that the case, and they didn't make that clear, then that's of course bad.
- duxup 9y ago
  Cutting off access to other email services in some cases can be a good choice.
pmiller2 9y ago
> given that anything said by it could be construed as a statement by the company itself. I don't think this reasoning holds up in this case, given that it was a Yahoo! messenger account with private messages to the employee's brother and fiancee that were in question. That aside, there are different standards in Europe, IIRC, for things like using work email and network resources for personal use. Most employers I'm aware of don't mind occasional personal use, even while at work, within reasonable parameters (e.g. browsing porn at work probably would not fly at most places, possibly even if it's only on the work network after hours). Many of us posting here now are probably posting from work. Another commenter mentioned that his wife occasionally sends him mail at his work email because she thinks it would be faster or something. All of these would probably be broadly acceptable outside of places like finance or defense contracting that heavily monitor and regulate their networks. I don't think such things are generally considered acceptable in Europe. (I am happy to be proven wrong, if anyone has firsthand knowledge, however.) I expect my work email to be monitored, because that's how US corporations work. I would never use my work email address to sign up for anything personal and important. I've got a device in my pocket that's linked to my personal email if I want to access something like that at work, anyway. In spite of my expectation that I'll be monitored using work accounts and on the work network, I still believe people should be told so explicitly. Not only should they be told that monitoring will occur, but they should be fully notified of what is and is not acceptable. This just seems basic to me. Oh, and BTW, and FYI, it's per se.

Karunamon 9y ago

Yeah.. I can't really find anything wrong or onerous with requiring a disclosure. Everyone should know, but just in case they don't, a piece of paper explaining this during onboarding isn't a huge deal.

koolba 9y ago
Where doesn't it end? You yourself just said that everyone should know. Rather than creating needless paperwork for everybody they'd be better served with a public relations campaign by the government to teach people that your work email is owned by your company which means they can read and monitor it.
- Karunamon 9y ago
  Somewhere around where the slippery slope fallacy starts. Snark aside, there's no real downside to mandating something in an employment contract that is probably already in most employment contracts anyways. This catches the stragglers.
  - gjjrfcbugxbhf 9y ago
    Why don't governments produce standard draft employment contacts? They already do so for many things (e.g. buying/renting property). Employer could ignore the standard or modify it and the employee could still amend it but it would help small companies get this sort of thing right and help with protecting both parties (which is the point of an employment contract).
    - vertex-four 9y ago
      In practice, lawyers will produce/modify standard contracts for extremely cheap, and as a bonus, if something goes wrong, you now have a relationship with a lawyer. If you're really cheap, in my country, you can literally go to the local book store and pick a model contract off the shelf. I don't think this is a problem that needs solving by the Government, since these contracts are essentially a commodity and have wound up being priced as such.

kozhevnikov 9y ago

It will as useful as EU's cookie law. Every employee on joining any company will be notified that corporate emails are monitored, similar to 'CCTV in operation' signs. It will be another checkbox on the contract.

golergka 9y ago
> It will be another checkbox on the contract. In my experience, employee contracts are negotiable in practice. I negotiated limiting or removing 'non-compete' clauses several times in different companies. If email checks were important for me (they're not) I would negotiate this term as well.
- ghughes 9y ago
  I doubt you’d get very far trying to negotiate this with any employer that has a legal department.
  - cannonedhamster 9y ago
    I've gotten non-disparagement clauses removed from a company with a legal team. If you're going to work for a company and they aren't willing to negotiate when things are the best between you two, you're likely not going to enjoy working there.
  - _delirium 9y ago
    In some European countries the union does this kind of negotiating in a sector/framework agreement, which can make pushing back against those kinds of blanket terms more effective, at least to the extent of reducing how broad the rights waivers are.
  - fulafel 9y ago
    There's a range of company sizes and attitudes to lawyering between the extremes of "we don't have a lawyer" and "corporate lawyers run the place".
  - golergka 9y ago

cbg0 9y ago

You can grab a PDF with more details from the European Court of Human Rights here: https://hudoc.echr.coe.int/eng-press?i=003-5825428-7419362 https://hudoc.echr.coe.int/eng-press?i=003-5825428-7419362 And judgement: https://hudoc.echr.coe.int/eng#{"itemid":["001-177082"] https://hudoc.echr.coe.int/eng#{"itemid":["001-177082"]}

PeachPlum 9y ago

This case is confused. The title and some of the editorial say "email" but the messages were sent via Yahoo Messenger, which isn't email. > The company had presented him with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use. I know the distinction is a fine one, but it is still a difference. They didn't need to produce a message, just having a non-business contact would have sufficed.

s73ver_ 9y ago
I don't think the court really cares if the messages were actual emails or if they were IMs. To them, the difference is immaterial.

turk183 9y ago

Big Brother running along unabated.

pmiller2 9y ago
That's the point of the ruling. The court just abated it.

KineticLensman 9y ago

The ruling itself is at [1]. It's a long slog at approx 200 paragraphs of legalese. The conclusions were that Article 8 [2] had been violated, and that as a result some of the applicant’s legal costs should be paid (EUR 1,365) but dismissed the applicant’s claim for substantial damages (loss of earnings and social standing, fiancée terminating their relationship). [1] https://hudoc.echr.coe.int/eng#{%22languageisocode%22:[%22ENG%22],%22documentcollectionid2%22:[%22JUDGMENTS%22],%22itemid%22:[%22001-177082%22] https://hudoc.echr.coe.int/eng#{%22languageisocode%22:[%22EN...} [2] Any person shall be enabled: (a) to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file; (b) to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form; ... (d) to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.”

PeachPlum 9y ago

While I have no desire to read an employees private correspondance, am even less desirous of paying money to store data I will get prosecuted for looking at!

babygoat 9y ago
Then don't.
- PeachPlum 9y ago
  People leave / die / are sick / go on holiday "I can't look in that Inbox, there might be an email from his brother" Puhleeze
  - s73ver_ 9y ago
    I've never needed to look into someone else's email because they weren't there.
    - zlynx 9y ago
      It happens all the time. Say that Adam handles technical support for some of your best customers, but he's out with pneumonia, or some other serious illness. He's not going to be responding to that urgent request for help with a new API feature, so you need to assign his inbox to Brian. Yes, if Adam had notice he was going to be out there'd be a controlled handoff, but that didn't happen, so you have to just open up his email and move onwards.
      - viridian 9y ago
        I have never in my life seen this happen. Typically we use mailing distributions where I work to avoid this issue. We also can only respond to clients using specific email addresses, like the one tied to the mailbox that multiple people have access to.
      - s73ver_ 9y ago

Delphiza 9y ago

The judgement highlights the balancing of "respect for his private life, on the one hand, and his employer’s right to take measures in order to ensure the smooth running of the company, on the other". While it is fair to expect that one "follows the rules", breach should not imply that your private life is something that the employer can do with what they wish, Especially, as the court decision notes, when the risks (e.g. damage and liability) are theoretical. Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private? It seems that the judgement is less about the monitoring and notification thereof, but whether or not you have an expectation for private things to remain private at work.

Godel_unicode 9y ago
> ...whether or not you have an expectation for private things to remain private at work Or to frame that question another way, if you have an expectation of privacy when you have taken no steps to ensure it and other privacy-protecting options abound. To extend your example, your wife could simply email your work address to say "you've got mail".
zeveb 9y ago
> Occasionally my wife will send me an email to my work address, because she thinks I may see it quicker. Does this use of company resources mean that the contents of the email can be used by the company, or is there an expectation that it is still private? I think that any expectation of privacy when using work resources to communicate is unreasonable — IOW, I believe it's illogical to expect that the company will not be aware of the fact that one has communicated. The question of whether the company may use the contents of such messages for its own purposes is a bit trickier, and I can see arguments in either direction. The best course of action is don't use an employer's resources for private purposes; then one cannot go astray.
- izacus 9y ago
  It's important to note that a lot of these privacy rules from a time when mobile phones and computers were not common. As such, pretty much the only way to contact an employee inside a workplace (for medical, personal, family, etc.) reasons was via company owned equipment. If your wife had to tell you she has cancer, she HAD to use the company equipment. As such, the stance was that it's resonable that workers can expect privacy even when phoning their family between breaks with company hardware. This is important to prevent employers abusing this information to gain leverage over workers (and if I recall, even in USA certain information is protected). And this is STILL the case in many industries - you're not allowed to carry your phone with you on a factory floor, so when something important happens, your personal communication MUST go through company owned equipment. In those cases, ensuring that employers don't needlessly invade employee privacy is rather reasonable. Remember, most of the world's workers aren't rockstar developers sitting in an office with their phones in the pocket.

izzydata 9y ago

Everything about this is fine and dandy, but I don't understand why anyone would use their work email for personal use. An email address isn't a difficult to obtain resource. Anyone can make a hundred email addresses and use all of them for different things. I guess the guy just never thought of it as an issue even if he was being monitored until it became an issue. I don't know.

nthao0ent23 9y ago
I'm finding them harder and harder to obtain privately. I wanted a free throw away email address recently, so I tried a few of the big names - yahoo, hotmail, outlook, gmail. I couldn't see a way to sign up for any one of these without giving out an existing email address to them. If I wanted something unconnected to anything else, I had no way to do that. I'm not sure how someone getting on the internet for the first time would do it with any free service. I'm not opposed to paying for an email account, but it does create a barrier to entry.
- piaste 9y ago
  Gmail asks you for your current email address, but it isn't actually required. I just tried it and made a new account in two clicks. I assume the same applies to at least some of the others.
- dkersten 9y ago
  If its throwaway, perhaps something like mailinator would do the trick?
- icebraining 9y ago
  Try outside the big ones? It takes only a few minutes to find one host that allows one to register without such stupidity.
1_800_UNICORN 9y ago
The number one reason I've seen is for things that need visibility during the work day. For example, if my girlfriend needs to email me something I need to take action on during the work day, she knows to email my work email. Same with people who are doing time sensitive things for me (e.g. my realtor during a recent home purchase). Sure, I could start monitoring my personal email just as closely as my work email, but it's preferable for me (and probably preferable for my company) that I use my work email for work & time sensitive personal items, and use my personal email only outside of work for non-time sensitive personal matters.

mc32 9y ago

Will this apply to automated email screening, the kind the big companies very likely do to get alerted to IP theft and the like? I would have to believe the likes of FB, Aapl, GOOG, MSFT, etc. likely have some process in place to detect exfiltration.

lisper 9y ago

I don't understand why this is even remotely controversial. I am as jealous a guard of my personal privacy as anyone, but I would expect my employer to be able to monitor my work-related email. The resolution is simple: conduct your personal correspondence through a separate email account that is not owned by your employer. In fact, I keep strictly segregated work and personal email, and I run my own company!

distances 9y ago
And I expect my employer to leave all my communication unmonitored, be it e-mail, snail mail or private face-to-face discussions. Here, controversy created.
- lisper 9y ago
  OK, please explain to me why you think that's reasonable?
  - distances 9y ago
    That's what the law says in Finland. Also, I personally believe the confidentiality of communication should never depend on the used medium or the ownership of the equipment used for the communication.
    - lisper 9y ago
      It's not about the ownership of the equipment, it's about whether the communications are official actions performed by an employee on behalf of the company. If they are, then the employer obviously (IMHO) has a right to know about them. And the best way to keep things from getting complicated (again IMHO) is to segregate work email (which the employer can read) from personal email (which no one but the user can read) in separate accounts. I really don't see how any reasonable person could disagree with that.

duxup 9y ago

I get there is a different tradition in Europe than compared to what I'm used to and that's cool. For me my company email is a company provided resource that they own and it belongs to them entirely. That includes their ability to monitor, read, or do most anything. No matter what the legal protections it seems like mixing personal life with work resources / tools carries an infinite number of possible issues and complications.

ucaetano 9y ago

Yay, another useless piece of information, like the "we use cookies" and "this entire building contains chemicals known to the state of California to cause cancer".

Kenji 9y ago

People who do private things with their work email are idiots. Separate work and private life clearly, it'll save you tons of headaches. They could dump the entirety of my work email publicly and I couldn't care less.